Jurisdictional issues and international co-operation in combating cybercrime Anne Flanagan Institute for Computer and Communications Law Centre for Commercial Law Studies, Queen Mary, University of London

Introductory Remarks l Transnational crime –Perpetrators, victims, evidence l e.g. UK airline bombers & Yahoo! s l Jurisdiction –Material & procedural (whether) –Extra-territorial –Resolving conflicts (which) l ‘Double jeopardy’ principle l Co-operation –Formal & informal

Jurisdiction: General principles l Jurisdiction to prescribe, adjudicate & enforce –All based on territorial sovereignty l Where the actus reus completed –Initiatory and terminatory elements l Where the ‘last act’ or ‘substantial part’ –civil law principle lex loci delicti commissi

Statutory provision l Content crimes –e.g. hate speech, child pornography, copyright l Jurisdictional conduct: ‘publish’, ‘supply’, ‘make available’..… –e.g. Waddon (2000): “..there can be publication on a Web site abroad, when images are there uploaded; and there can be further publication when those images are downloaded elsewhere.” l Computer-related crimes –EU Framework Decision ‘combating fraud’ (2001) l “in whole or in part within its territory…” –instructions l ex parte Levin [1996] 4 All ER 350

Statutory provision l Computer integrity crimes –EU Framework Decision ‘attacks against information systems’ (2001) l “in whole or in part within its territory…” –e.g. Computer Misuse Act 1990: “at least one significant link” l the accused, the computer or the unauthorised modification –US: ‘protected computer’ (18 U.S.C § 1030(e)(2)(B)) l “located outside the United States that is used in a manner that affects interstate or foreign commerce or communication of the United States”

Extra-territorial application of jurisdiction l Principles –‘active personality’ principle: the offender is a national of the territory ; –‘passive personality’ principle: the victim is a national of the territory; –‘protective' principle’: in order to safeguard the national interest; –‘universality’ principle: international crimes l Law –Convention, art. 22(1)(d); Framework Decision, art. 10(1)(b) l “by one of its nationals” l Problems

Jurisdictional conflicts l Convention, art. 22(5): –‘When more than one Party claims jurisdiction over an alleged offence….the Parties involved shall, where appropriate, consult with a view to determining the most appropriate jurisdiction for prosecution’ l Eurojust Guidelines (2003) –Timing? l As soon as possible! –Whom? l Senior prosecutors

Jurisdictional conflicts –Criteria? l Presumption: majority of criminality occurred or loss sustained l Relevant factors –Location of accused, e.g. possibility of extradition or transfer of proceedings –Attendance of witnesses –Impact of delays on fairness of trial –Interests of victims, e.g. possibility of compensation –Availability of evidence, e.g. location & admissibility l Non-relevant or secondary considerations –Relative penalties available –Ability to recover proceeds of crime

Remote investigations l Legality of law enforcement action –exercise of power l e.g. Schengen Convention re: ‘hot surveillance’ l e.g. Convention on Mutual Assistance in Criminal Matters (2000) –‘remote control’ (art. 19) and ‘spillover’ (art. 20) –data access & obtaining l e.g. United States v. Gorshkov (2001) l Cybercrime Convention –Art. 18: ‘possession or control’ –Art. 32: ‘open source’ l publicly available (open source) l lawful and voluntary consent

International co-operation l Moving evidence: Mutual Legal Assistance –General principles l ‘letter rogatory’ in respect of proceedings or an investigation l ‘specialty principle’ l ‘dual criminality’ principle not applicable, except where it involves the use of search and seizure powers –EU Framework Decision (2008) l ‘European Evidence Warrant’ –Only for existing data & documents –Provision in 60 days or less, inc. ‘computer-related crime’ l 2005 Proposal: ‘principle of availability’ –Obtaining access to foreign LEA databases

International co-operation l Moving people: Extradition –Lengthy process l e.g. Levin (2 yrs) and McKinnon (since November 2002) –‘dual criminality’ principle l e.g. Cybercrime Convention: “by deprivation of liberty for a maximum period of at least one year, or by a more severe penalty.” l Exception for ‘European Arrest Warrant’ countries –obligation to prosecute: ‘aut dedere aut judicare’ l EU Decision, art. 10(3) & Convention, art. 22(3)

LEA co-operation l 24/7 networks l Legal basis –Convention, art. 35, EU Framework Decision, art. 11 l Institutional basis –G8 (55 countries), Interpol National Central Reference Points (122 countries) l Features –English-speaking, technically & legally competent l Urgent investigations & preservation of evidence –Early warning system

Concluding remarks